Re: Can lower layer tell there's connectivity? (Was: Re: New issue 16: No packets from other end?)

 In your previous mail you wrote:

   There appears to be several questions here. What Pasi is stating
   need to made more specific before we can find agreement.
   I think we are talking about:
   
   (1) Difference wrt IP layer connectivity and the ability to
        talk between the IKEv2 peers.
   
        There is indeed a difference, the IKEv2 module could
        suddenly die... or the client could have been disconnected
        and the address recycled to someone else.
   
        Personally, I'm not sure this is worth covering. IP
        connectivity should be enough. But see (2) below.
   
=> we need both: IP connectivity and IKEv2 dead peer detection.
None is really a part of MOBIKE.

   (2) Ensuring that a given address really is the same
        node. When probing for the correctness of a claimed
        address, we may want to ensure that its indeed the
        same IKEv2 node at this address.
   
=> I agree: RR checks are the job of MOBIKE.

        It seems that the only way to do this is an IKEv2
        message. But note that we are talking about address
        update, not failure recovery here. So failure recovery
        might still work using only IP layer connectivity
        tests.
   
=> IMHO recovery should have the priority over RR checks. Note this
doesn't introduce a security issue because recovery is local and
will happen without RR checks in a non-IPsec context.

   (3) What current lower layers are able to tell to MOBIKE.
        This is what I have been saying, that as far as I know,
        current lower layer support in IPv6, DNA, DHC, etc.
        only provides support for the discovery of available
        addresses and locally operational addresses. Not the
        discovery operational address pairs.
   
=> this is clearly the main job of a multi-homing control and
without it multi-homing is not really usable (*).

        I'm not saying that it wouldn't be possible to develop
        one, just that one doesn't exist now. But I could be
        missing something, I'm sure you guys will tell me what...
   
=> the question is more who should develop one.

Regards

[email protected]

PS (*): two remarks:
 - as there is currently no specified multi-homing control mechanism
   we are in trouble, with and without IPsec.
 - IMHO this is not the job of MOBIKE to provide this function, nor
   the job of the MOBIKE WG to specify one in place of the MULTI6 WG.